A company stores sensitive documents in an Azure Storage account. Security requires that the storage account be accessible only over the organization's private virtual network and that traffic never traverse the public internet. Which Azure feature should be implemented?